Julie DiMauro: Let's keep the compliance monitor’s report confidential

Julie DiMauro: Let's keep the compliance monitor’s report confidential

By Julie DiMauro | Thursday, January 21, 2016 at 3:18AM

The use of corporate monitors by judicial and regulatory government agencies to verify an organization’s compliance with settlement agreements and orders resolving corporate accountability continues to rise. The growing use of monitors has raised questions about the privacy of their reports and the public’s access to their findings.
To support and protect important and sensitive data-collection efforts and the level of trust monitors require to perform their jobs, these reports to the government and courts should remain completely off-limits to the general public, including litigants to separate causes of action.
In July 2013, Eastern District of New York Judge John Gleeson approved a five-year Deferred Prosecution Agreement (DPA) with HSBC Bank USA N.A. and HSBC Holdings plc, after the companies were found to be in violation of the Bank Secrecy Act for failing to maintain an effective anti-money laundering (AML) program.
In so doing, Judge Gleeson held that a district court has the authority to approve or reject a DPA and to supervise its implementation. The HSBC DPA requires the bank to retain an independent compliance monitor to ensure that it fulfills the terms of the DPA and implements recommended remedial measures.
The monitor completed its first annual report and submitted it to the Department of Justice (DOJ), which the DOJ summarized in a quarterly report and gave to Judge Gleeson. The judge requested the full copy of the monitor’s 1,000-page report, which the bank and the DOJ requested be submitted under seal. The monitor and his team have nearly completed the second annual report and are on target to deliver it to the DOJ on January 20.
In November 2015, a private individual, Hubert Dean Moore, who used to have a mortgage with HSBC, sued to have the monitor’s first annual report unsealed by the court. He sent a letter to Judge Gleeson, arguing that he should be provided access to the monitor’s report to help support a complaint he had filed with the Consumer Financial Protection Bureau (CFPB).
This action prompted the DOJ to file its opposition to the court on December 11, arguing that the report was not a “judicial document” to which the public should have access.
The DOJ noted that the DPA contained language regarding the parties’ intent to keep the monitor reports non-public and described how the Department believes such a public disclosure would impede the monitor’s ability to fulfill his responsibilities.
HSBC said publishing the monitor’s report would undermine the purpose of the monitoring by compromising the monitor’s and government’s ability to assess HSBC’s progress in improving its anti-money laundering and sanctions compliance programs.
The bank said publication would “negatively affect the ability of HSBC’s financial regulators to fully discharge their supervisory responsibilities over HSBC,” and would provide criminals seeking to engage in activities such as money laundering or terrorist financing a road map for exploiting current weakness in the anti-money laundering and sanctions programs at the institution.
The corporate monitor’s role is to ensure that the company not only meets the financial terms of its settlement agreement, but, more importantly, to make sure the company enhances its compliance and ethics program, policies, procedures and processes to prevent these issues from occurring again.
The corporate monitor begins executing his or her duties by developing a work plan that will include a timeline for reaching certain milestones.
Inherent in the corporate monitor’s work plan is the ability to learn about and get to know the company, its employees and its clients or customers. This allows the corporate monitor to understand the culture and risk tolerance of the company in a way that goes beyond examining documents.
For a compliance monitor to be effective, his or her candid discussions with those inside the company and others rests on a level of trust and privacy that would be compromised if their reports were made public. It is also a disincentive to those who would want to serve as a compliance monitor that their work product could be dissected by other litigants or any other member of the public, undercutting their independence.
Let's hope the monitor’s report stays sealed and that the terms of the agreement among the parties are honored.
_____
Julie DiMauro is a contributing editor of the FCPA Blog. She works in the Regulatory Intelligence group at Thomson Reuters in New York. Follow Julie on Twitter @Julie_DiMauro and email her at julie.dimauro@thomsonreuters.com.

- See more at: http://www.fcpablog.com/blog/2016/1/21/julie-dimauro-lets-keep-the-compliance-monitors-report-confi.html#sthash.AXLqIaUL.dpuf

Security will be key public sector cloud adoption driver by 2018, predicts Gartner

Caroline Donnelly

Datacentre Editor

20 Jan 2016 15:36

Gartner predicts that by 2018 government agencies will be citing security as a reason to move to public cloud rather than to stay away from it

http://www.computerweekly.com/news/4500271375/Security-to-overtake-cost-as-key-cloud-adoption-driver-for-public-sector-by-2018-claims-Gartner?utm_medium=EM&asrc=EM_EDA_52551203&utm_campaign=20160121_Security%20will%20be%20key%20public%20sector%20cloud%20adoption%20driver%20by%202018,%20predicts%20Gartner_&utm_source=EDA

Bas de Groot

Consultant at Verdonck, Klooster & Associates

De nieuwe Europese Privacyverordening

Jan 20, 2016

Na bijna vier jaar onderhandelen en lobbyen is er overeenstemming over de Algemene Verordening Gegevensbescherming (AVGB). Begin dit jaar moet het Europees Parlement nog formeel instemmen, daarna hebben (publieke en private) organisaties twee jaar totdat de verordening in werking treedt. In deze blog een eerste indruk van de nu voorliggende tekst, met bepalingen die relevant zijn voor Nederlandse organisaties.
Veel rechten voor individuenDe mogelijkheid voor individuen om zelf te bepalen wat met er hun data gebeurt is een belangrijk element in de verordening. Organisaties krijgen een specifieke informatieplicht voor de wijze waarop zij persoonsgegevens verwerken en ondubbelzinnige toestemming van de betrokkene is een vereiste. Ook worden organisaties verplicht om datalekken te melden bij de toezichthouder en de betrokkene (in Nederland geldt deze verplichting overigens al).
Verplichte Data Protection Officer voor een aantal organisatiesOrganisaties die veel of gevoelige persoonsgegevens verwerken moeten een Data Protection Officer (DPO) aanstellen. De DPO is aanspreekpunt voor privacyzaken, rapporteert aan de directie en is in zijn functie min of meer autonoom. Daarnaast is het zijn taak om te zorgen dat de organisatie compliant is met privacywetgeving.
Verplichtingen bewerker nemen toeHostingbedrijven, cloudaanbieders en online boekhoudprogramma’s zijn voorbeelden van wat de wet ‘bewerkers’ noemt: zij verwerken persoonsgegevens in opdracht van een organisatie, de verantwoordelijke. Bewerkers krijgen aanmerkelijk meer verantwoordelijkheden; zij moeten kunnen aantonen dat de beveiliging van persoonsgegevens technisch en organisatorisch in orde is.
Privacy by design wordt belangrijkerDe privacyverordening verplicht organisaties om bij de ontwikkeling van een product of dienst in een vroeg stadium rekening te houden met privacy-aspecten, zoals doelbinding en beveiliging van persoonsgegevens. Daarnaast zijn privacyvriendelijke instellingen (privacy by default) straks de norm.
Documentatieplicht neemt toeDe verantwoordelijke en de bewerker moeten straks bijhouden bij welke activiteiten persoonsgegevens worden verwerkt. Dit document bevat een beschrijving van het type persoonsgegevens, het doel van de verwerking en – indien mogelijk – een beschrijving van de genomen technische en organisatorische beveiligingsmaatregelen.
Is uw organisatie er klaar voor?De boodschap van de privacyverordening voor organisaties is helder: zorg dat u tijdig in control bent bij het verwerken van persoonsgegevens. Toezichthouders krijgen ook middelen om dit af te dwingen, met als maximum een administratieve sanctie van 20 miljoen euro of 4% van de wereldwijde jaaromzet.
Het is daarom van belang dat uw organisatie privacy op directieniveau agendeert en organisatiebreed implementeert. VKA kan u hierbij helpen, door het leveren van advies of door het invullen van de rol van DPO. Zie ook www.vka.nl/privacy.

Report this

• 

  Written by

  Bas de Groot

New data classifications vital to information governance and security

by
Jeffrey Ritter

University of Oxford

Businesses have invested heavily in information governance and security, and embracing three new data classifications could prove beneficial in 2016.

This Article Covers

Governance and compliance

 Companies have learned that in order to leverage the economic and functional efficiencies that technology such as mobile devices and cloud computing make possible, information security investments are essential. This will be no different in 2016, as corporate boards and management teams continue to recognize the importance of information governance to their overall compliance strategies and programs.

Increased security spending does more than protect against malicious actors. The dollars also improve the integrity and reliability of all of the data moving across a digital ecosystem. For any business, secure digital information is increasingly valued for being a factually accurate record that serves as authoritative evidence of the truth. While 2015 was a remarkable year for data governance, there are three new information classifications that will be vital to immediate, short-term business strategies this year.

Log data as evidence

Several businesses have turned to the cloud to store the immense volumes of performance and log data that computers generate as evidence of the company's operational effectiveness. In turn, vendors large and small are creating big data analytic tools that can evaluate log data to detect anomalies and variations much earlier than in previous iterations.

Too often, the push for accelerated software releases or system development takes precedent over effective information governance and security.

In the past, records management and IT teams have not considered these volumes of log data as functionally important to the corporate compliance program objectives. However, the data has huge value for law enforcement and in legal cases. Log data can often serve as evidence that contradicts oral testimony or even the content of other digital records. For example, the time stamp on an email server log may contradict information on a print-out of that email.
Information governance and security processes can leverage log data to benefit the corporate compliance program's objectives. By developing effective governance, the same log data can be evaluated to help identify miscommunications, improper contacts, trading irregularities, unauthorized purchasing and similar activities that are often the basis for enforcement investigations and litigation.

Software design documentation

The Volkswagen fuel sensor incident has placed the spotlight on a second category of documents and records that has been overlooked by traditional records and IT management practices: Software design documentation. On first impression, software and information system engineers are no different than the architects of homes and office buildings. They produce a design (blueprint) of the end result, and then build it. But as with contractors, the as-built final product is often very different than the original design.

Innovations in software and systems design are enabling more rapid prototyping, version releases and corrections of bugs and defects both before and after the release of an application or system. The DevOps team embraces these innovations because it provides continuous delivery to users while the product is still being refined and enhanced.

Through all of these activities, enormous volumes of supporting documentation can be produced. But with the emphasis on the velocity of revisions, structured governance of the documentation is rarely executed. If the end product fails, is tested and found dysfunctional (as in Volkswagen's case), or is investigated for compliance under the new legal rules governing systems design, the documentation (or the inability to find and produce the documentation) can be game-changing.
Information governance and security personnel should connect with development teams at the earliest stages of each new project to create the information classifications and controls for relevant data. The teams should also produce design documentation that is considered part of the organization's overall information governance program.

Blockchain implementations

While Bitcoin has received a great deal of attention as a digital currency, its underlying blockchaining technology may produce far more dramatic shifts in how corporations create and preserve information records. With blockchaining, there is no central repository of each record or digital asset. Instead, blockchaining divides information assets such as transaction records into blocks. It then encrypts each block and distributes the blocks across a large network of participating systems and devices. Blockchaining provides a highly reliable record in which trust is vested in the consensus of the collective of the participating systems rather than the central repository.

Jeffrey Ritter asks:

How do you think information classifications, such as blockchain and log data, will influence data security and governance processes in 2016?
0  Responses
Join the Discussion
Prev
1. 1
2. 2
Next

Major financial institutions and venture firms are making heavy investments in blockchain innovations. The information governance challenge, of course, is that the records and digital assets included in blockchain pilots or launch roll-outs are still business records that must follow existing mandates stipulating preservation, access control, availability, and destruction rules. If information governance is disregarded, later legal inquiries or calls to produce the primary records could be troublesome.
For each of these three new information classifications, the data management team and drivers of the corporate compliance program will serve their organizations well if they reach out and collaborate with other IT teams. Too often, the push for accelerated software releases or system development takes precedent over effective information governance and security. Collaboration will help assure that the project budgets for these activities properly anticipate the related information governance expenses and their associated benefits.

Tim Cook's Message to the White House: Get Behind Real Encryption With No 'Backdoors'

Tim Cook's Message to the White House: Get Behind Real Encryption With No 'Backdoors'

The Apple CEO has become an outspoken defender of privacy rights.

Jim Epstein|Jan. 16, 2016 10:30 am

At a meeting of tech leaders organized by the White House last week, Apple CEO Tim Cook called on the Obama administration to come out in support of real encryption with no loopholes. As The Intercept reports,

The White House should come out and say “no backdoors,” Cook said. That would mean overruling repeated requests from FBI Director James Comey and other administration officials that tech companies build some sort of special access for law enforcement into otherwise unbreakable encryption. Technologists agree that any such measure could be exploited by others.
But Attorney General Loretta Lynch responded to Cook by speaking of the “balance” necessary between privacy and national security — a balance that continues to be debated within the administration.

Cook has become an outspoken defender of privacy rights, making a case that the feds shouldn't interfere with encryption on CBS' 60 Minutes in December. "There have been people that suggest that we should have a backdoor," he told interviewer Charlie Rose. "But the reality is if you put a backdoor in, that backdoor’s for everybody, for good guys and bad guys.”

https://www.linkedin.com/pulse/9-maatregelen-voor-de-meldplicht-datalekken-per-1-harry?trk=hp-feed-article-title-share

Meldplicht Datalekken: 9 Maatregelen die iedere organisatie zou moeten nemen

Dec 7, 2015

Vanaf 1 januari 2016 wordt de Meldplicht Datalekken van kracht. Hierbij een InfoGraphic met 9 maatregelen die iedere organisatie zou moeten treffen.

___________________
Harry Heijligers is Data Protection Officer bij The Privacy Factory. Zijn missie is het leveren van een bijdrage aan een Veilige Digitale Wereld. Zijn laatste boek, How the World of Wow begins Now! (Amazon, 2015), geeft inzicht in hoe de nabije toekomst eruit komt te zien als gevolg van Internet of Things en de privacy uitdagingen die dat met zich meebrengt. Zijn laatste blog op PrivacyProtectie.nl gaat over de aankomende nieuwe Europese regelgeving op het gebied van data protectie: Impact van de General Data Protection Regulation op jouw organisatie.

Je bent hier: Home » Nieuws » Cyberincidenten grootste nieuwe bedreiging voor bedrijven

Cyberincidenten grootste nieuwe bedreiging voor bedrijven

13 januari 2016

Onderbreking van de lopende zaken (‘Business interruption’), marktontwikkelingen en cyberincidenten zijn de drie grootste bedrijfsrisico’s wereldwijd. Business interruption staat voor het vierde jaar op een rij aan de top. Dit blijkt uit de vijfde jaarlijkse Allianz Risk Barometer, gehouden onder achthonderd risico-experts uit meer dan veertig landen. In deze barometer zet Allianz de grootste bedrijfsgevaren voor 2016 op een rij. 
Bedrijven raken steeds bezorgder over cyberincidenten. Bij dit gevaar is het zeer waarschijnlijk dat het Business Interruption bevordert. Veel ondernemingen hebben te weinig kennis of budget om dit risico te verminderen, terwijl de dreiging steeds groter wordt. Hackers zijn niet het enige probleem; ook zaken die de operationele technoligie in gevaar brengen, resulteren in grote systeemonderbrekingen.

Risico’s wereldwijd

Risico’s verschillen per land en per continent. De risico-top 5 in Europa bestaat uit:

1. Business interruption (supply chain);
2. marktontwikkelingen (volatiliteit, concurrentie en stagnatie)
3. Cyberincidenten;
4. Veranderende wet-en regelgeving;
5. Macro-economische ontwikkelingen (inflatie, deflatie).